SIOCGIWSCAN-race

["Lars Ericsson" <Lars_Ericsson@telia.com>]

[-- Attachment #1: Type: text/plain, Size: 960 bytes --]

Hi Johannes,

I have discovered and patched a race in the scanning function since a couple
of releases.
To day I checked the current Linux git and the problem is still there.

The problem is the sequence of events when the scan result is reported back.
The wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL); 
is called before ieee80211_hw_config(local);

ieee80211_hw_config(local) will trig the wpa_supplicant to select an AP. 
That may happen before the ieee80211_hw_config() is executed since the
wpa_supplicant
generated actions is executed by an other thread (wpa_supplicant).

The result is that:
- wpa_supplicant setup for an association to an ap using correct channel.
- ieee80211_hw_config() reset the channel to the value before the SCAN
started.
- the association request will be sent out using the wrong channel.


Attached you will find the patch for 2.6.27. 
It is not a perfect patch since the code is duplicated but it works :)


Regards
Lars

[-- Attachment #2: lae-mac80211-mlme-SIOCGIWSCAN-race.patch --]
[-- Type: application/octet-stream, Size: 1264 bytes --]

diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
old mode 100644
new mode 100755
index b404537..fd9e726
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3788,10 +3788,6 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 	struct ieee80211_sub_if_data *sdata;
 	union iwreq_data wrqu;
 
-	local->last_scan_completed = jiffies;
-	memset(&wrqu, 0, sizeof(wrqu));
-	wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
-
 	if (local->sta_hw_scanning) {
 		local->sta_hw_scanning = 0;
 		if (ieee80211_hw_config(local))
@@ -3803,6 +3799,10 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 			ieee80211_restart_sta_timer(sdata);
 		rcu_read_unlock();
 
+		local->last_scan_completed = jiffies;
+		memset(&wrqu, 0, sizeof(wrqu));
+		wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
+
 		goto done;
 	}
 
@@ -3811,6 +3811,9 @@ void ieee80211_scan_completed(struct ieee80211_hw *hw)
 		printk(KERN_DEBUG "%s: failed to restore operational "
 		       "channel after scan\n", dev->name);
 
+	local->last_scan_completed = jiffies;
+	memset(&wrqu, 0, sizeof(wrqu));
+	wireless_send_event(dev, SIOCGIWSCAN, &wrqu, NULL);
 
 	netif_tx_lock_bh(local->mdev);
 	local->filter_flags &= ~FIF_BCN_PRBRESP_PROMISC;